KVM: MMU: fix for calculating gpa in invlpg code
[safe/jmp/linux-2.6] / arch / x86 / kvm / paging_tmpl.h
index 322e811..3464fdb 100644 (file)
@@ -27,7 +27,8 @@
        #define guest_walker guest_walker64
        #define FNAME(name) paging##64_##name
        #define PT_BASE_ADDR_MASK PT64_BASE_ADDR_MASK
-       #define PT_DIR_BASE_ADDR_MASK PT64_DIR_BASE_ADDR_MASK
+       #define PT_LVL_ADDR_MASK(lvl) PT64_LVL_ADDR_MASK(lvl)
+       #define PT_LVL_OFFSET_MASK(lvl) PT64_LVL_OFFSET_MASK(lvl)
        #define PT_INDEX(addr, level) PT64_INDEX(addr, level)
        #define PT_LEVEL_MASK(level) PT64_LEVEL_MASK(level)
        #define PT_LEVEL_BITS PT64_LEVEL_BITS
@@ -43,7 +44,8 @@
        #define guest_walker guest_walker32
        #define FNAME(name) paging##32_##name
        #define PT_BASE_ADDR_MASK PT32_BASE_ADDR_MASK
-       #define PT_DIR_BASE_ADDR_MASK PT32_DIR_BASE_ADDR_MASK
+       #define PT_LVL_ADDR_MASK(lvl) PT32_LVL_ADDR_MASK(lvl)
+       #define PT_LVL_OFFSET_MASK(lvl) PT32_LVL_OFFSET_MASK(lvl)
        #define PT_INDEX(addr, level) PT32_INDEX(addr, level)
        #define PT_LEVEL_MASK(level) PT32_LEVEL_MASK(level)
        #define PT_LEVEL_BITS PT32_LEVEL_BITS
@@ -53,8 +55,8 @@
        #error Invalid PTTYPE value
 #endif
 
-#define gpte_to_gfn FNAME(gpte_to_gfn)
-#define gpte_to_gfn_pde FNAME(gpte_to_gfn_pde)
+#define gpte_to_gfn_lvl FNAME(gpte_to_gfn_lvl)
+#define gpte_to_gfn(pte) gpte_to_gfn_lvl((pte), PT_PAGE_TABLE_LEVEL)
 
 /*
  * The guest_walker structure emulates the behavior of the hardware page
@@ -71,14 +73,9 @@ struct guest_walker {
        u32 error_code;
 };
 
-static gfn_t gpte_to_gfn(pt_element_t gpte)
+static gfn_t gpte_to_gfn_lvl(pt_element_t gpte, int lvl)
 {
-       return (gpte & PT_BASE_ADDR_MASK) >> PAGE_SHIFT;
-}
-
-static gfn_t gpte_to_gfn_pde(pt_element_t gpte)
-{
-       return (gpte & PT_DIR_BASE_ADDR_MASK) >> PAGE_SHIFT;
+       return (gpte & PT_LVL_ADDR_MASK(lvl)) >> PAGE_SHIFT;
 }
 
 static bool FNAME(cmpxchg_gpte)(struct kvm *kvm,
@@ -125,13 +122,15 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
        gpa_t pte_gpa;
        int rsvd_fault = 0;
 
-       pgprintk("%s: addr %lx\n", __func__, addr);
+       trace_kvm_mmu_pagetable_walk(addr, write_fault, user_fault,
+                                    fetch_fault);
 walk:
        walker->level = vcpu->arch.mmu.root_level;
        pte = vcpu->arch.cr3;
 #if PTTYPE == 64
        if (!is_long_mode(vcpu)) {
                pte = kvm_pdptr_read(vcpu, (addr >> 30) & 3);
+               trace_kvm_mmu_paging_element(pte, walker->level);
                if (!is_present_gpte(pte))
                        goto not_present;
                --walker->level;
@@ -150,10 +149,11 @@ walk:
                pte_gpa += index * sizeof(pt_element_t);
                walker->table_gfn[walker->level - 1] = table_gfn;
                walker->pte_gpa[walker->level - 1] = pte_gpa;
-               pgprintk("%s: table_gfn[%d] %lx\n", __func__,
-                        walker->level - 1, table_gfn);
 
-               kvm_read_guest(vcpu->kvm, pte_gpa, &pte, sizeof(pte));
+               if (kvm_read_guest(vcpu->kvm, pte_gpa, &pte, sizeof(pte)))
+                       goto not_present;
+
+               trace_kvm_mmu_paging_element(pte, walker->level);
 
                if (!is_present_gpte(pte))
                        goto not_present;
@@ -162,7 +162,7 @@ walk:
                if (rsvd_fault)
                        goto access_error;
 
-               if (write_fault && !is_writeble_pte(pte))
+               if (write_fault && !is_writable_pte(pte))
                        if (user_fault || is_write_protection(vcpu))
                                goto access_error;
 
@@ -170,11 +170,13 @@ walk:
                        goto access_error;
 
 #if PTTYPE == 64
-               if (fetch_fault && is_nx(vcpu) && (pte & PT64_NX_MASK))
+               if (fetch_fault && (pte & PT64_NX_MASK))
                        goto access_error;
 #endif
 
                if (!(pte & PT_ACCESSED_MASK)) {
+                       trace_kvm_mmu_set_accessed_bit(table_gfn, index,
+                                                      sizeof(pte));
                        mark_page_dirty(vcpu->kvm, table_gfn);
                        if (FNAME(cmpxchg_gpte)(vcpu->kvm, table_gfn,
                            index, pte, pte|PT_ACCESSED_MASK))
@@ -186,18 +188,24 @@ walk:
 
                walker->ptes[walker->level - 1] = pte;
 
-               if (walker->level == PT_PAGE_TABLE_LEVEL) {
-                       walker->gfn = gpte_to_gfn(pte);
-                       break;
-               }
-
-               if (walker->level == PT_DIRECTORY_LEVEL
-                   && (pte & PT_PAGE_SIZE_MASK)
-                   && (PTTYPE == 64 || is_pse(vcpu))) {
-                       walker->gfn = gpte_to_gfn_pde(pte);
-                       walker->gfn += PT_INDEX(addr, PT_PAGE_TABLE_LEVEL);
-                       if (PTTYPE == 32 && is_cpuid_PSE36())
+               if ((walker->level == PT_PAGE_TABLE_LEVEL) ||
+                   ((walker->level == PT_DIRECTORY_LEVEL) &&
+                               is_large_pte(pte) &&
+                               (PTTYPE == 64 || is_pse(vcpu))) ||
+                   ((walker->level == PT_PDPE_LEVEL) &&
+                               is_large_pte(pte) &&
+                               is_long_mode(vcpu))) {
+                       int lvl = walker->level;
+
+                       walker->gfn = gpte_to_gfn_lvl(pte, lvl);
+                       walker->gfn += (addr & PT_LVL_OFFSET_MASK(lvl))
+                                       >> PAGE_SHIFT;
+
+                       if (PTTYPE == 32 &&
+                           walker->level == PT_DIRECTORY_LEVEL &&
+                           is_cpuid_PSE36())
                                walker->gfn += pse36_gfn_delta(pte);
+
                        break;
                }
 
@@ -208,6 +216,7 @@ walk:
        if (write_fault && !is_dirty_gpte(pte)) {
                bool ret;
 
+               trace_kvm_mmu_set_dirty_bit(table_gfn, index, sizeof(pte));
                mark_page_dirty(vcpu->kvm, table_gfn);
                ret = FNAME(cmpxchg_gpte)(vcpu->kvm, table_gfn, index, pte,
                            pte|PT_DIRTY_MASK);
@@ -239,6 +248,7 @@ err:
                walker->error_code |= PFERR_FETCH_MASK;
        if (rsvd_fault)
                walker->error_code |= PFERR_RSVD_MASK;
+       trace_kvm_mmu_walker_error(walker->error_code);
        return 0;
 }
 
@@ -248,12 +258,17 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
        pt_element_t gpte;
        unsigned pte_access;
        pfn_t pfn;
-       int largepage = vcpu->arch.update_pte.largepage;
+       u64 new_spte;
 
        gpte = *(const pt_element_t *)pte;
        if (~gpte & (PT_PRESENT_MASK | PT_ACCESSED_MASK)) {
-               if (!is_present_gpte(gpte))
-                       __set_spte(spte, shadow_notrap_nonpresent_pte);
+               if (!is_present_gpte(gpte)) {
+                       if (page->unsync)
+                               new_spte = shadow_trap_nonpresent_pte;
+                       else
+                               new_spte = shadow_notrap_nonpresent_pte;
+                       __set_spte(spte, new_spte);
+               }
                return;
        }
        pgprintk("%s: gpte %llx spte %p\n", __func__, (u64)gpte, spte);
@@ -266,9 +281,13 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
        if (mmu_notifier_retry(vcpu, vcpu->arch.update_pte.mmu_seq))
                return;
        kvm_get_pfn(pfn);
+       /*
+        * we call mmu_set_spte() with reset_host_protection = true beacuse that
+        * vcpu->arch.update_pte.pfn was fetched from get_user_pages(write = 1).
+        */
        mmu_set_spte(vcpu, spte, page->role.access, pte_access, 0, 0,
-                    gpte & PT_DIRTY_MASK, NULL, largepage,
-                    gpte_to_gfn(gpte), pfn, true);
+                    gpte & PT_DIRTY_MASK, NULL, PT_PAGE_TABLE_LEVEL,
+                    gpte_to_gfn(gpte), pfn, true, true);
 }
 
 /*
@@ -276,7 +295,7 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
  */
 static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                         struct guest_walker *gw,
-                        int user_fault, int write_fault, int largepage,
+                        int user_fault, int write_fault, int hlevel,
                         int *ptwrite, pfn_t pfn)
 {
        unsigned access = gw->pt_access;
@@ -295,14 +314,13 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
        for_each_shadow_entry(vcpu, addr, iterator) {
                level = iterator.level;
                sptep = iterator.sptep;
-               if (level == PT_PAGE_TABLE_LEVEL
-                   || (largepage && level == PT_DIRECTORY_LEVEL)) {
+               if (iterator.level == hlevel) {
                        mmu_set_spte(vcpu, sptep, access,
                                     gw->pte_access & access,
                                     user_fault, write_fault,
                                     gw->ptes[gw->level-1] & PT_DIRTY_MASK,
-                                    ptwrite, largepage,
-                                    gw->gfn, pfn, false);
+                                    ptwrite, level,
+                                    gw->gfn, pfn, false, true);
                        break;
                }
 
@@ -315,12 +333,15 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                        kvm_flush_remote_tlbs(vcpu->kvm);
                }
 
-               if (level == PT_DIRECTORY_LEVEL
-                   && gw->level == PT_DIRECTORY_LEVEL) {
+               if (level <= gw->level) {
+                       int delta = level - gw->level + 1;
                        direct = 1;
-                       if (!is_dirty_gpte(gw->ptes[level - 1]))
+                       if (!is_dirty_gpte(gw->ptes[level - delta]))
                                access &= ~ACC_WRITE_MASK;
-                       table_gfn = gpte_to_gfn(gw->ptes[level - 1]);
+                       table_gfn = gpte_to_gfn(gw->ptes[level - delta]);
+                       /* advance table_gfn when emulating 1gb pages with 4k */
+                       if (delta == 0)
+                               table_gfn += PT_INDEX(addr, level);
                } else {
                        direct = 0;
                        table_gfn = gw->table_gfn[level - 2];
@@ -373,7 +394,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
        int write_pt = 0;
        int r;
        pfn_t pfn;
-       int largepage = 0;
+       int level = PT_PAGE_TABLE_LEVEL;
        unsigned long mmu_seq;
 
        pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
@@ -399,14 +420,11 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                return 0;
        }
 
-       if (walker.level == PT_DIRECTORY_LEVEL) {
-               gfn_t large_gfn;
-               large_gfn = walker.gfn & ~(KVM_PAGES_PER_HPAGE-1);
-               if (is_largepage_backed(vcpu, large_gfn)) {
-                       walker.gfn = large_gfn;
-                       largepage = 1;
-               }
+       if (walker.level >= PT_DIRECTORY_LEVEL) {
+               level = min(walker.level, mapping_level(vcpu, walker.gfn));
+               walker.gfn = walker.gfn & ~(KVM_PAGES_PER_HPAGE(level) - 1);
        }
+
        mmu_seq = vcpu->kvm->mmu_notifier_seq;
        smp_rmb();
        pfn = gfn_to_pfn(vcpu->kvm, walker.gfn);
@@ -423,8 +441,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                goto out_unlock;
        kvm_mmu_free_some_pages(vcpu);
        sptep = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
-                            largepage, &write_pt, pfn);
-
+                            level, &write_pt, pfn);
        pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __func__,
                 sptep, *sptep, write_pt);
 
@@ -446,7 +463,6 @@ out_unlock:
 static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
 {
        struct kvm_shadow_walk_iterator iterator;
-       pt_element_t gpte;
        gpa_t pte_gpa = -1;
        int level;
        u64 *sptep;
@@ -458,12 +474,17 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
                level = iterator.level;
                sptep = iterator.sptep;
 
-               /* FIXME: properly handle invlpg on large guest pages */
-               if (level == PT_PAGE_TABLE_LEVEL ||
-                   ((level == PT_DIRECTORY_LEVEL) && is_large_pte(*sptep))) {
+               if (level == PT_PAGE_TABLE_LEVEL  ||
+                   ((level == PT_DIRECTORY_LEVEL && is_large_pte(*sptep))) ||
+                   ((level == PT_PDPE_LEVEL && is_large_pte(*sptep)))) {
                        struct kvm_mmu_page *sp = page_header(__pa(sptep));
+                       int offset, shift;
 
-                       pte_gpa = (sp->gfn << PAGE_SHIFT);
+                       shift = PAGE_SHIFT -
+                                 (PT_LEVEL_BITS - PT64_LEVEL_BITS) * level;
+                       offset = sp->role.quadrant << shift;
+
+                       pte_gpa = (sp->gfn << PAGE_SHIFT) + offset;
                        pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
 
                        if (is_shadow_present_pte(*sptep)) {
@@ -482,33 +503,36 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
 
        if (need_flush)
                kvm_flush_remote_tlbs(vcpu->kvm);
+
+       atomic_inc(&vcpu->kvm->arch.invlpg_counter);
+
        spin_unlock(&vcpu->kvm->mmu_lock);
 
        if (pte_gpa == -1)
                return;
-       if (kvm_read_guest_atomic(vcpu->kvm, pte_gpa, &gpte,
-                                 sizeof(pt_element_t)))
+
+       if (mmu_topup_memory_caches(vcpu))
                return;
-       if (is_present_gpte(gpte) && (gpte & PT_ACCESSED_MASK)) {
-               if (mmu_topup_memory_caches(vcpu))
-                       return;
-               kvm_mmu_pte_write(vcpu, pte_gpa, (const u8 *)&gpte,
-                                 sizeof(pt_element_t), 0);
-       }
+       kvm_mmu_pte_write(vcpu, pte_gpa, NULL, sizeof(pt_element_t), 0);
 }
 
-static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
+static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr, u32 access,
+                              u32 *error)
 {
        struct guest_walker walker;
        gpa_t gpa = UNMAPPED_GVA;
        int r;
 
-       r = FNAME(walk_addr)(&walker, vcpu, vaddr, 0, 0, 0);
+       r = FNAME(walk_addr)(&walker, vcpu, vaddr,
+                            !!(access & PFERR_WRITE_MASK),
+                            !!(access & PFERR_USER_MASK),
+                            !!(access & PFERR_FETCH_MASK));
 
        if (r) {
                gpa = gfn_to_gpa(walker.gfn);
                gpa |= vaddr & ~PAGE_MASK;
-       }
+       } else if (error)
+               *error = walker.error_code;
 
        return gpa;
 }
@@ -552,12 +576,16 @@ static void FNAME(prefetch_page)(struct kvm_vcpu *vcpu,
 static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 {
        int i, offset, nr_present;
+       bool reset_host_protection;
+       gpa_t first_pte_gpa;
 
        offset = nr_present = 0;
 
        if (PTTYPE == 32)
                offset = sp->role.quadrant << PT64_LEVEL_BITS;
 
+       first_pte_gpa = gfn_to_gpa(sp->gfn) + offset * sizeof(pt_element_t);
+
        for (i = 0; i < PT64_ENT_PER_PAGE; i++) {
                unsigned pte_access;
                pt_element_t gpte;
@@ -567,8 +595,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
                if (!is_shadow_present_pte(sp->spt[i]))
                        continue;
 
-               pte_gpa = gfn_to_gpa(sp->gfn);
-               pte_gpa += (i+offset) * sizeof(pt_element_t);
+               pte_gpa = first_pte_gpa + i * sizeof(pt_element_t);
 
                if (kvm_read_guest_atomic(vcpu->kvm, pte_gpa, &gpte,
                                          sizeof(pt_element_t)))
@@ -589,9 +616,16 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 
                nr_present++;
                pte_access = sp->role.access & FNAME(gpte_access)(vcpu, gpte);
+               if (!(sp->spt[i] & SPTE_HOST_WRITEABLE)) {
+                       pte_access &= ~ACC_WRITE_MASK;
+                       reset_host_protection = 0;
+               } else {
+                       reset_host_protection = 1;
+               }
                set_spte(vcpu, &sp->spt[i], pte_access, 0, 0,
-                        is_dirty_gpte(gpte), 0, gfn,
-                        spte_to_pfn(sp->spt[i]), true, false);
+                        is_dirty_gpte(gpte), PT_PAGE_TABLE_LEVEL, gfn,
+                        spte_to_pfn(sp->spt[i]), true, false,
+                        reset_host_protection);
        }
 
        return !nr_present;
@@ -603,9 +637,10 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 #undef PT_BASE_ADDR_MASK
 #undef PT_INDEX
 #undef PT_LEVEL_MASK
-#undef PT_DIR_BASE_ADDR_MASK
+#undef PT_LVL_ADDR_MASK
+#undef PT_LVL_OFFSET_MASK
 #undef PT_LEVEL_BITS
 #undef PT_MAX_FULL_LEVELS
 #undef gpte_to_gfn
-#undef gpte_to_gfn_pde
+#undef gpte_to_gfn_lvl
 #undef CMPXCHG